Buggy code:
public class KerberosTokenValidator implements Validator { private static final Logger LOG = org . slf4j . LoggerFactory . getLogger ( KerberosTokenValidator . class ) ; private String serviceName ; private CallbackHandler callbackHandler ; private String contextName ; private KerberosTokenDecoder kerberosTokenDecoder ; private boolean isUsernameServiceNameForm ; private boolean spnego ; public String getContextName ( ) { } public void setContextName ( String contextName ) { } public CallbackHandler getCallbackHandler ( ) { } public void setCallbackHandler ( CallbackHandler callbackHandler ) { } public void setServiceName ( String serviceName ) { } public String getServiceName ( ) { } public KerberosTokenDecoder getKerberosTokenDecoder ( ) { } public void setKerberosTokenDecoder ( KerberosTokenDecoder kerberosTokenDecoder ) { } public Credential validate ( Credential credential , RequestData data ) throws WSSecurityException { if ( ( credential == null ) || ( ( credential . getBinarySecurityToken ( ) ) == null ) ) { throw new WSSecurityException ( ErrorCode . FAILURE , "noCredential" ) ; } BinarySecurity binarySecurity = credential . getBinarySecurityToken ( ) ; if ( ! ( binarySecurity instanceof KerberosSecurity ) ) { return credential ; } if ( KerberosTokenValidator . LOG . isDebugEnabled ( ) ) { try { String jaasAuth = System . getProperty ( "java.security.auth.login.config" ) ; String krbConf = System . getProperty ( "java.security.krb5.conf" ) ; KerberosTokenValidator . LOG . debug ( ( "KerberosTokenValidator<seq2seq4repair_space>-<seq2seq4repair_space>Using<seq2seq4repair_space>JAAS<seq2seq4repair_space>auth<seq2seq4repair_space>login<seq2seq4repair_space>file:<seq2seq4repair_space>" + jaasAuth ) ) ; KerberosTokenValidator . LOG . debug ( ( "KerberosTokenValidator<seq2seq4repair_space>-<seq2seq4repair_space>Using<seq2seq4repair_space>KRB<seq2seq4repair_space>conf<seq2seq4repair_space>file:<seq2seq4repair_space>" + krbConf ) ) ; } catch ( SecurityException ex ) { KerberosTokenValidator . LOG . debug ( ex . getMessage ( ) , ex ) ; } } LoginContext loginContext = null ; try { if ( ( callbackHandler ) != null ) { loginContext = new LoginContext ( getContextName ( ) , callbackHandler ) ; } else if ( ( data . getCallbackHandler ( ) ) != null ) { loginContext = new LoginContext ( getContextName ( ) , data . getCallbackHandler ( ) ) ; } else { loginContext = new LoginContext ( getContextName ( ) ) ; } loginContext . login ( ) ; } catch ( LoginException ex ) { if ( KerberosTokenValidator . LOG . isDebugEnabled ( ) ) { KerberosTokenValidator . LOG . debug ( ex . getMessage ( ) , ex ) ; } throw new WSSecurityException ( ErrorCode . FAILURE , "kerberosLoginError" , ex , ex . getMessage ( ) ) ; } if ( KerberosTokenValidator . LOG . isDebugEnabled ( ) ) { KerberosTokenValidator . LOG . debug ( "Successfully<seq2seq4repair_space>authenticated<seq2seq4repair_space>to<seq2seq4repair_space>the<seq2seq4repair_space>TGT" ) ; } byte [ ] token = binarySecurity . getToken ( ) ; Subject subject = loginContext . getSubject ( ) ; String service = serviceName ; if ( service == null ) { Set < Principal > principals = subject . getPrincipals ( ) ; if ( principals . isEmpty ( ) ) { throw new WSSecurityException ( ErrorCode . FAILURE , "kerberosLoginError" , "No<seq2seq4repair_space>Client<seq2seq4repair_space>principals<seq2seq4repair_space>found<seq2seq4repair_space>after<seq2seq4repair_space>login" ) ; } service = principals . iterator ( ) . next ( ) . getName ( ) ; } KerberosServiceExceptionAction action = new KerberosServiceExceptionAction ( token , service , isUsernameServiceNameForm ( ) , spnego ) ; KerberosServiceContext krbServiceCtx = null ; try { krbServiceCtx = Subject . doAs ( subject , action ) ; } catch ( PrivilegedActionException e ) { Throwable cause = e . getCause ( ) ; if ( cause instanceof WSSecurityException ) { throw ( ( WSSecurityException ) ( cause ) ) ; } else { <START_BUG> throw new WSSecurityException ( ErrorCode . FAILURE , "kerberosTicketValidationError" , new Object [ ] { } , cause ) ; <END_BUG> } } credential . setPrincipal ( krbServiceCtx . getPrincipal ( ) ) ; credential . setDelegationCredential ( krbServiceCtx . getDelegationCredential ( ) ) ; KerberosTokenValidator . LOG . debug ( "Trying<seq2seq4repair_space>to<seq2seq4repair_space>obtain<seq2seq4repair_space>the<seq2seq4repair_space>Session<seq2seq4repair_space>Key<seq2seq4repair_space>from<seq2seq4repair_space>the<seq2seq4repair_space>KerberosServiceContext." ) ; Key sessionKey = krbServiceCtx . getSessionKey ( ) ; if ( null != sessionKey ) { KerberosTokenValidator . LOG . debug ( "Found<seq2seq4repair_space>session<seq2seq4repair_space>key<seq2seq4repair_space>in<seq2seq4repair_space>the<seq2seq4repair_space>KerberosServiceContext." ) ; credential . setSecretKey ( sessionKey . getEncoded ( ) ) ; } else { KerberosTokenValidator . LOG . debug ( "Session<seq2seq4repair_space>key<seq2seq4repair_space>is<seq2seq4repair_space>not<seq2seq4repair_space>found<seq2seq4repair_space>in<seq2seq4repair_space>the<seq2seq4repair_space>KerberosServiceContext." ) ; } if ( null == ( credential . getSecretKey ( ) ) ) { KerberosTokenDecoder kerberosTokenDecoder = this . kerberosTokenDecoder ; if ( kerberosTokenDecoder == null ) { kerberosTokenDecoder = new KerberosTokenDecoderImpl ( ) ; } KerberosTokenValidator . LOG . debug ( "KerberosTokenDecoder<seq2seq4repair_space>is<seq2seq4repair_space>set.Trying<seq2seq4repair_space>to<seq2seq4repair_space>obtain<seq2seq4repair_space>the<seq2seq4repair_space>session<seq2seq4repair_space>key<seq2seq4repair_space>from<seq2seq4repair_space>it." ) ; kerberosTokenDecoder . clear ( ) ; kerberosTokenDecoder . setToken ( token ) ; kerberosTokenDecoder . setSubject ( subject ) ; try { byte [ ] key = kerberosTokenDecoder . getSessionKey ( ) ; if ( null != key ) { KerberosTokenValidator . LOG . debug ( "Session<seq2seq4repair_space>key<seq2seq4repair_space>obtained<seq2seq4repair_space>from<seq2seq4repair_space>the<seq2seq4repair_space>KerberosTokenDecoder." ) ; credential . setSecretKey ( key ) ; } else { KerberosTokenValidator . LOG . debug ( "Session<seq2seq4repair_space>key<seq2seq4repair_space>could<seq2seq4repair_space>not<seq2seq4repair_space>be<seq2seq4repair_space>obtained<seq2seq4repair_space>from<seq2seq4repair_space>the<seq2seq4repair_space>KerberosTokenDecoder." ) ; } } catch ( KerberosTokenDecoderException e ) { throw new WSSecurityException ( ErrorCode . FAILURE , "Error<seq2seq4repair_space>retrieving<seq2seq4repair_space>session<seq2seq4repair_space>key." , e ) ; } } else { KerberosTokenValidator . LOG . debug ( "KerberosTokenDecoder<seq2seq4repair_space>is<seq2seq4repair_space>not<seq2seq4repair_space>set." ) ; } if ( KerberosTokenValidator . LOG . isDebugEnabled ( ) ) { KerberosTokenValidator . LOG . debug ( "Successfully<seq2seq4repair_space>validated<seq2seq4repair_space>a<seq2seq4repair_space>ticket" ) ; } return credential ; } public boolean isUsernameServiceNameForm ( ) { } public void setUsernameServiceNameForm ( boolean isUsernameServiceNameForm ) { } public boolean isSpnego ( ) { } public void setSpnego ( boolean spnego ) { } }

Fix:
throw new WSSecurityException ( ErrorCode . FAILURE , "kerberosTicketValidationError" , cause ) ;